JVM Application Error Logs Indicating Potential JNDI Injection Exploitation
Alerts when JVM application error logs include JNDI/LDAP and Log4j JndiManager keyword indicators.
- Product
- jvm
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags JVM-based applications emitting error-level log messages that contain strings associated with JNDI lookups over LDAP and Log4j JNDI handling (e.g., com.sun.jndi.ldap.* and org.apache.logging.log4j.core.net.JndiManager). Attackers can use JNDI injection to coerce the application into performing unintended remote lookups, often as part of broader exploitation attempts. The detection relies on collected application error logs and keyword matching for the presence of these JNDI-related indicators.
Reporting behind it
- wix.engineeringhttps://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- secariolabs.comhttps://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: JVM Application Error Logs Indicating Potential JNDI Injection Exploitation
id: 47ae9e5d-8372-4500-87bf-08baf4e1e32f
status: test
description: This rule flags JVM-based applications emitting error-level log messages that contain strings associated with JNDI lookups over LDAP and Log4j JNDI handling (e.g., com.sun.jndi.ldap.* and org.apache.logging.log4j.core.net.JndiManager). Attackers can use JNDI injection to coerce the application into performing unintended remote lookups, often as part of broader exploitation attempts. The detection relies on collected application error logs and keyword matching for the presence of these JNDI-related indicators.
references:
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: jvm
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- com.sun.jndi.ldap.
- org.apache.logging.log4j.core.net.JndiManager
condition: keywords
falsepositives:
- Application bugs
level: high
license: DRL-1.1
related:
- id: bb0e9cec-d4da-46f5-997f-22efc59f3dca
type: derived